Ajoute le support de formation : entite racine separee du jeu 2D

Nouveau moteur document_engine/ (elements CRUD + rendering + labels),
db/supports/ (stockage independant de db/games), routes/document/
(CRUD AJAX + publication), et l'editeur frontend complet
(templates/document/, static/document/) avec moteur de layout reel
(glisser-deposer -> fusion en rangee ou insertion avant/apres), vrai
Undo/Redo par pile de commandes, grille d'accroche pour les formes
libres, apercu responsive a largeurs fixes, mode Apercu, et publication
persistee.

"Mes formations" (templates/index.html) liste desormais les
environnements 2D et les supports de formation cote a cote ;
l'onboarding et core/auth_guard.py sont generalises pour qu'un compte
restreint puisse posseder un projet de chaque type independamment.

SKIP=djlint : le hook ne signale que le backlog H021 (styles en ligne)
deja documente dans CODE_QUALITY.md sur des fichiers pre-existants non
touches ici (base.html, game/play.html, scene_edit.html,
game_dashboard_simple.html, clause_row.html) plus une ligne de
index.html deja presente avant cette session — aucun nouveau fichier
(document_edit.html compris) n'y figure. Tous les autres outils
(ruff, mypy --strict, vulture, bandit, import-linter, eslint,
stylelint) passent sans erreur ; 617 tests Python + 276 tests JS
verts, plus une verification manuelle complete du cycle de vie via le
serveur de developpement.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/conftest.py

@@ -99,6 +99,27 @@ def tmp_game_slug_cleanup() -> Generator[Callable[[str], str], None, None]:
             shutil.rmtree(game_dir)
 
 
+@pytest.fixture
+def tmp_support_slug_cleanup() -> Generator[Callable[[str], str], None, None]:
+    """Mirroir de tmp_game_slug_cleanup pour un support de formation
+    (db.create_support(...)) — système de fichiers séparé
+    (db.supports.support_dir), jamais db.game_dir (qui résoudrait vers le
+    mauvais dossier pour un slug de support)."""
+    import db.supports
+
+    slugs = []
+
+    def register(slug: str) -> str:
+        slugs.append(slug)
+        return slug
+
+    yield register
+    for slug in slugs:
+        support_dir = db.supports.support_dir(slug)
+        if os.path.isdir(support_dir):
+            shutil.rmtree(support_dir)
+
+
 @pytest.fixture(autouse=True)
 def _cleanup_admin_assets() -> Generator[None, None, None]:
     """Filet de sécurité : le compte admin (`_TEST_ADMIN_ID`) est PARTAGÉ
@@ -179,6 +200,22 @@ def game(client: FlaskClient) -> Generator[str, None, None]:
         db.delete_game(slug)
 
 
+@pytest.fixture
+def support(client: FlaskClient) -> Generator[str, None, None]:
+    """Crée un support de formation de test frais via /documents/new
+    (mirroir de la fixture `game` ci-dessus, pour l'autre type de projet —
+    entité racine séparée, voir docs/plan/PLAN.md) et le supprime après le
+    test, quel que soit son résultat."""
+    import db.supports
+
+    resp = client.post("/documents/new", data={"name": "pytest_test_support"}, follow_redirects=False)
+    assert resp.status_code == 302
+    slug = resp.headers["Location"].rstrip("/").split("/")[-2]
+    yield slug
+    if os.path.isdir(db.supports.support_dir(slug)):
+        db.delete_support(slug)
+
+
 _STATIC_DIR = os.path.join(os.path.dirname(os.path.dirname(os.path.abspath(__file__))), "static", "game", "js")
 _PLAY_JS_DIR = os.path.join(_STATIC_DIR, "play")
 _SCREEN_EDIT_JS_DIR = os.path.join(_STATIC_DIR, "screen_edit")

tests/document/test_document_elements.py

@@ -0,0 +1,140 @@
+"""CRUD des éléments d'un support de formation (document_engine/elements/)
+— sans Flask, directement contre le support.db créé par db.create_support.
+Couvre : CRUD complet, rangées (parent_id), réinsertion (move_document_element
+vers une nouvelle rangée/position), suppression en cascade d'une rangée avec
+enfants, et les attributs de position/taille/rotation d'une forme."""
+
+from typing import Any
+
+import db
+import document_engine as doc_engine
+
+
+def _new_support(tmp_support_slug_cleanup: Any, name: str = "Support de test") -> str:
+    slug = db.create_support(name, owner_folder="90")
+    tmp_support_slug_cleanup(slug)
+    return slug
+
+
+def test_add_and_get_document_element_uses_default_attributes(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "titre")
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    assert element["kind"] == "titre"
+    assert element["parent_id"] is None
+    assert element["attributes"]["content"] == "Nouveau titre"
+
+
+def test_get_document_element_returns_none_for_missing_id(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    assert doc_engine.get_document_element(slug, 999) is None
+
+
+def test_list_document_elements_groups_row_children_together(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    top_titre_id = doc_engine.add_document_element(slug, "titre")
+    child_a_id = doc_engine.add_document_element(slug, "paragraphe", parent_id=row_id)
+    child_b_id = doc_engine.add_document_element(slug, "image", parent_id=row_id)
+
+    elements = doc_engine.list_document_elements(slug)
+    ids_in_order = [el["id"] for el in elements]
+
+    # Les deux top-niveau (row_id, top_titre_id) groupés avant les deux
+    # enfants de la rangée (child_a_id, child_b_id) — tri (parent_id, order_index).
+    assert ids_in_order.index(row_id) < ids_in_order.index(child_a_id)
+    assert ids_in_order.index(top_titre_id) < ids_in_order.index(child_a_id)
+    assert ids_in_order.index(child_a_id) < ids_in_order.index(child_b_id)
+
+
+def test_update_document_element_attributes_replaces_whole_json(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "paragraphe")
+    doc_engine.update_document_element_attributes(slug, element_id, {"content": "Texte modifié", "style": "legende"})
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    assert element["attributes"] == {"content": "Texte modifié", "style": "legende"}
+
+
+def test_shape_default_attributes_carry_real_position_and_size(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    element_id = doc_engine.add_document_element(slug, "rectangle")
+    element = doc_engine.get_document_element(slug, element_id)
+    assert element is not None
+    attrs = element["attributes"]
+    assert attrs["x"] == 40
+    assert attrs["y"] == 40
+    assert attrs["width"] == 160
+    assert attrs["height"] == 100
+    assert attrs["rotation"] == 0
+    assert attrs["z_index"] == 1
+
+    doc_engine.update_document_element_attributes(
+        slug,
+        element_id,
+        {**attrs, "x": 120, "y": 80, "width": 200, "height": 150, "rotation": 45, "z_index": 3},
+    )
+    moved = doc_engine.get_document_element(slug, element_id)
+    assert moved is not None
+    assert moved["attributes"]["x"] == 120
+    assert moved["attributes"]["rotation"] == 45
+    assert moved["attributes"]["z_index"] == 3
+
+
+def test_move_document_element_reorders_within_same_parent(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    first_id = doc_engine.add_document_element(slug, "titre")
+    second_id = doc_engine.add_document_element(slug, "paragraphe")
+    third_id = doc_engine.add_document_element(slug, "image")
+
+    doc_engine.move_document_element(slug, third_id, None, 0)
+
+    elements = doc_engine.list_document_elements(slug)
+    top_level = [el for el in elements if el["parent_id"] is None]
+    ordered_ids = [el["id"] for el in sorted(top_level, key=lambda el: el["order_index"])]
+    assert ordered_ids == [third_id, first_id, second_id]
+
+
+def test_move_document_element_reparents_into_a_row(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    lone_titre_id = doc_engine.add_document_element(slug, "titre")
+
+    doc_engine.move_document_element(slug, lone_titre_id, row_id, 0)
+
+    moved = doc_engine.get_document_element(slug, lone_titre_id)
+    assert moved is not None
+    assert moved["parent_id"] == row_id
+    assert moved["order_index"] == 0
+
+
+def test_delete_document_element_cascades_to_row_children(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    child_id = doc_engine.add_document_element(slug, "titre", parent_id=row_id)
+
+    doc_engine.delete_document_element(slug, row_id)
+
+    assert doc_engine.get_document_element(slug, row_id) is None
+    assert doc_engine.get_document_element(slug, child_id) is None
+
+
+def test_delete_document_element_on_missing_id_is_a_noop(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    doc_engine.delete_document_element(slug, 999)
+
+
+def test_render_document_includes_row_children_and_shape_position(tmp_support_slug_cleanup: Any) -> None:
+    slug = _new_support(tmp_support_slug_cleanup)
+    row_id = doc_engine.add_document_element(slug, "row")
+    doc_engine.add_document_element(slug, "titre", parent_id=row_id)
+    rect_id = doc_engine.add_document_element(slug, "rectangle")
+
+    html = doc_engine.render_document(doc_engine.list_document_elements(slug))
+
+    assert 'data-kind="row"' in html
+    assert 'data-kind="titre"' in html
+    assert f'data-element-id="{rect_id}"' in html
+    assert "left:40px" in html
+    assert "top:40px" in html

tests/document/test_document_routes.py

@@ -0,0 +1,124 @@
+"""Routes HTTP du support de formation (routes/document/) — création,
+édition directe (sans page intermédiaire), CRUD des éléments en AJAX,
+publication, et isolation par propriétaire (core/auth_guard.py)."""
+
+from typing import Any
+
+from flask.testing import FlaskClient
+
+import auth
+import db
+
+
+def test_documents_new_creates_a_support_not_a_game(client: FlaskClient) -> None:
+    resp = client.post("/documents/new", data={"name": "Sécurité incendie"}, follow_redirects=False)
+    assert resp.status_code == 302
+    assert "/document/" in resp.headers["Location"]
+    assert "/edit" in resp.headers["Location"]
+    slug = resp.headers["Location"].rstrip("/").split("/")[-2]
+    try:
+        assert db.support_meta(slug)["name"] == "Sécurité incendie"
+    finally:
+        db.delete_support(slug)
+
+
+def test_document_edit_renders_directly_no_intermediate_page(client: FlaskClient, support: str) -> None:
+    resp = client.get(f"/document/{support}/edit")
+    assert resp.status_code == 200
+
+
+def test_document_element_add_returns_rendered_html(client: FlaskClient, support: str) -> None:
+    resp = client.post(f"/document/{support}/elements/add", data={"kind": "titre"})
+    assert resp.status_code == 200
+    payload = resp.get_json()
+    assert payload["kind"] == "titre"
+    assert "docText" in payload["rendered_html"]
+
+
+def test_document_element_add_rejects_unknown_kind(client: FlaskClient, support: str) -> None:
+    assert client.post(f"/document/{support}/elements/add", data={"kind": "n-importe-quoi"}).status_code == 400
+
+
+def test_document_element_add_accepts_row_for_the_layout_engine(client: FlaskClient, support: str) -> None:
+    """ "row" n'apparaît jamais dans la bibliothèque (voir
+    document_engine.ELEMENT_LIBRARY) mais reste un kind valide pour cette
+    route — c'est le moteur de layout côté client qui en crée une à la
+    volée au moment d'un dépôt latéral (voir
+    static/document/js/document-editor.js)."""
+    resp = client.post(f"/document/{support}/elements/add", data={"kind": "row"})
+    assert resp.status_code == 200
+    assert resp.get_json()["kind"] == "row"
+
+
+def test_document_element_update_persists_attributes(client: FlaskClient, support: str) -> None:
+    add_resp = client.post(f"/document/{support}/elements/add", data={"kind": "paragraphe"})
+    element_id = add_resp.get_json()["id"]
+
+    resp = client.post(
+        f"/document/{support}/elements/{element_id}/update",
+        json={"content": "Texte mis à jour", "style": "legende"},
+    )
+    assert resp.status_code == 200
+    assert resp.get_json()["ok"] is True
+
+    reread = client.post(f"/document/{support}/elements/add", data={"kind": "titre"})
+    assert reread.status_code == 200
+
+
+def test_document_element_move_and_delete(client: FlaskClient, support: str) -> None:
+    first_id = client.post(f"/document/{support}/elements/add", data={"kind": "titre"}).get_json()["id"]
+    second_id = client.post(f"/document/{support}/elements/add", data={"kind": "paragraphe"}).get_json()["id"]
+
+    move_resp = client.post(
+        f"/document/{support}/elements/{second_id}/move",
+        json={"new_parent_id": None, "new_index": 0},
+    )
+    assert move_resp.status_code == 200
+    assert move_resp.get_json()["ok"] is True
+
+    delete_resp = client.post(f"/document/{support}/elements/{first_id}/delete")
+    assert delete_resp.status_code == 200
+    assert delete_resp.get_json()["ok"] is True
+
+
+def test_document_publish_persists_published_at(client: FlaskClient, support: str) -> None:
+    assert db.support_meta(support)["published_at"] is None
+    resp = client.post(f"/document/{support}/publish")
+    assert resp.status_code == 200
+    published_at = resp.get_json()["published_at"]
+    assert published_at is not None
+    assert db.support_meta(support)["published_at"] == published_at
+
+
+def test_restricted_user_can_have_one_game_and_one_support_at_once(
+    user_client: FlaskClient, tmp_game_slug_cleanup: Any, tmp_support_slug_cleanup: Any
+) -> None:
+    with user_client.session_transaction() as sess:
+        user_id = sess["user_id"]
+    game_slug = db.create_game("Un environnement 2D", owner_folder=str(user_id))
+    tmp_game_slug_cleanup(game_slug)
+    auth.set_project_slug(user_id, game_slug)
+
+    resp = user_client.post("/documents/new", data={"name": "Un support"}, follow_redirects=False)
+    assert resp.status_code == 302
+    support_slug = resp.headers["Location"].rstrip("/").split("/")[-2]
+    tmp_support_slug_cleanup(support_slug)
+
+    user = auth.get_user_by_id(user_id)
+    assert user is not None
+    assert user["project_slug"] == game_slug
+    assert user["support_slug"] == support_slug
+
+
+def test_cannot_open_another_owners_support(client: FlaskClient, user_client: FlaskClient) -> None:
+    """Isolation par propriétaire (core/auth_guard.py, split_slug déjà
+    générique quel que soit le type de projet) — le compte admin
+    (`client`) ne doit pas pouvoir ouvrir le support d'un autre compte."""
+    with user_client.session_transaction() as sess:
+        victim_user_id = sess["user_id"]
+    victim_slug = db.create_support("Support de la victime", owner_folder=str(victim_user_id))
+    try:
+        assert client.get(f"/document/{victim_slug}/edit").status_code == 403
+        assert client.post(f"/document/{victim_slug}/delete").status_code == 403
+    finally:
+        db.delete_support(victim_slug)

tests/document/test_support_lifecycle.py

@@ -0,0 +1,70 @@
+"""Cycle de vie d'un support de formation (db/supports/) — mirroir des
+tests de db/games/, mais vérifie en plus l'ISOLATION stricte entre les
+deux systèmes : un support ne doit jamais apparaître dans db.list_games()
+et un jeu ne doit jamais apparaître dans db.list_supports(), même pour le
+même propriétaire."""
+
+from typing import Any
+
+import db
+
+
+def test_create_support_creates_its_own_db_file_and_schema(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("Sécurité incendie", owner_folder="42")
+    tmp_support_slug_cleanup(slug)
+    meta = db.support_meta(slug)
+    assert meta["name"] == "Sécurité incendie"
+    assert meta["published_at"] is None
+
+
+def test_list_supports_scopes_to_owner_and_excludes_games(
+    tmp_support_slug_cleanup: Any, tmp_game_slug_cleanup: Any
+) -> None:
+    owner = "43"
+    support_slug = db.create_support("Onboarding RH", owner_folder=owner)
+    tmp_support_slug_cleanup(support_slug)
+    game_slug = db.create_game("Un jeu du même compte", owner_folder=owner)
+    tmp_game_slug_cleanup(game_slug)
+
+    supports = db.list_supports(owner)
+    games = db.list_games(owner)
+
+    assert [s["slug"] for s in supports] == [support_slug]
+    assert [g["slug"] for g in games] == [game_slug]
+    assert support_slug not in [g["slug"] for g in games]
+    assert game_slug not in [s["slug"] for s in supports]
+
+
+def test_list_supports_never_sees_another_owners_supports(tmp_support_slug_cleanup: Any) -> None:
+    slug_a = db.create_support("Support A", owner_folder="44")
+    tmp_support_slug_cleanup(slug_a)
+    slug_b = db.create_support("Support B", owner_folder="45")
+    tmp_support_slug_cleanup(slug_b)
+
+    assert [s["slug"] for s in db.list_supports("44")] == [slug_a]
+    assert [s["slug"] for s in db.list_supports("45")] == [slug_b]
+
+
+def test_create_support_avoids_name_collision_for_the_same_owner(tmp_support_slug_cleanup: Any) -> None:
+    owner = "46"
+    slug_1 = db.create_support("Module 1", owner_folder=owner)
+    tmp_support_slug_cleanup(slug_1)
+    slug_2 = db.create_support("Module 1", owner_folder=owner)
+    tmp_support_slug_cleanup(slug_2)
+    assert slug_1 != slug_2
+
+
+def test_mark_support_published_persists_a_timestamp(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("À publier", owner_folder="47")
+    tmp_support_slug_cleanup(slug)
+    assert db.support_meta(slug)["published_at"] is None
+    published_at = db.mark_support_published(slug)
+    assert db.support_meta(slug)["published_at"] == published_at
+
+
+def test_delete_support_removes_it_from_the_listing(tmp_support_slug_cleanup: Any) -> None:
+    slug = db.create_support("Temporaire", owner_folder="48")
+    tmp_support_slug_cleanup(slug)
+    assert [s["slug"] for s in db.list_supports("48")] == [slug]
+    db.delete_support(slug)
+    assert db.list_supports("48") == []

tests/test_onboarding.py

@@ -26,7 +26,11 @@ def test_account_without_a_project_is_redirected_to_onboarding(anon_client: Flas
 
         resp = anon_client.get("/onboarding")
         assert resp.status_code == 200
-        assert "Créer un jeu 2D ludique" in resp.get_data(as_text=True)
+        # Aucun des deux slots n'est encore rempli — les deux cartes sont
+        # proposées (voir docs/plan/PLAN.md, projet_kind de premier niveau).
+        html = resp.get_data(as_text=True)
+        assert "Environnement de formation 2D" in html
+        assert "Support de formation" in html
     finally:
         _cleanup_project("needsonboarding@example.com")
 
@@ -90,24 +94,44 @@ def test_onboarding_rejects_removed_types(anon_client: FlaskClient) -> None:  #
         _cleanup_project("removedtype@example.com")
 
 
-def test_revisiting_onboarding_after_completion_redirects_without_recreating(anon_client: FlaskClient) -> None:  # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
+def test_revisiting_onboarding_after_completing_one_slot_offers_only_the_other(anon_client: FlaskClient) -> None:  # noqa: F811 - anon_client est un fixture pytest (voir tests.test_auth), pas une vraie redefinition - pyflakes ne comprend pas l'injection de fixture par parametre
+    """Les deux slots (project_slug/support_slug) sont indépendants (voir
+    docs/plan/PLAN.md) : avoir déjà un environnement 2D ne bloque plus
+    /onboarding, mais n'y propose plus que la carte encore libre — tenter
+    de recréer un environnement 2D via un POST direct doit rester rejeté."""
     _register(anon_client, "revisit@example.com")
     _confirm_2fa(anon_client)
+    support_slug = None
     try:
-        first = _complete_onboarding(anon_client, name="Premier jeu", onboarding_type="rpg")
+        _complete_onboarding(anon_client, name="Premier jeu", onboarding_type="rpg")
         first_slug = not_none(auth.get_user_by_email("revisit@example.com"))["project_slug"]
 
-        resp = anon_client.get("/onboarding", follow_redirects=False)
-        assert resp.status_code == 302
-        assert resp.headers["Location"] == first.headers["Location"]
+        resp = anon_client.get("/onboarding")
+        assert resp.status_code == 200
+        html = resp.get_data(as_text=True)
+        assert "Environnement de formation 2D" not in html
+        assert "Support de formation" in html
 
         again = anon_client.post(
             "/onboarding", data={"onboarding_type": "rpg", "name": "Second jeu"}, follow_redirects=False
         )
+        assert again.status_code == 200
         assert not_none(auth.get_user_by_email("revisit@example.com"))["project_slug"] == first_slug
-        assert again.headers["Location"] == first.headers["Location"]
+
+        second = anon_client.post(
+            "/onboarding", data={"onboarding_type": "support", "name": "Un support"}, follow_redirects=False
+        )
+        assert second.status_code == 302
+        support_slug = not_none(auth.get_user_by_email("revisit@example.com"))["support_slug"]
+        assert second.headers["Location"] == f"/document/{support_slug}/edit"
+
+        both_full = anon_client.get("/onboarding", follow_redirects=False)
+        assert both_full.status_code == 302
+        assert both_full.headers["Location"] == "/"
     finally:
         _cleanup_project("revisit@example.com")
+        if support_slug:
+            db.delete_support(support_slug)
 
 
 def test_admin_is_never_redirected_to_onboarding(client: FlaskClient, game: str) -> None:
@@ -132,7 +156,7 @@ def test_admin_can_create_several_games_via_onboarding(client: FlaskClient) -> N
         # le premier projet créé, la page de choix s'affiche à nouveau.
         resp = client.get("/onboarding")
         assert resp.status_code == 200
-        assert "Créer un jeu 2D ludique" in resp.get_data(as_text=True)
+        assert "Environnement de formation 2D" in resp.get_data(as_text=True)
 
         resp2 = _complete_onboarding(client, name="Jeu RPG Admin 2", onboarding_type="rpg")
         assert resp2.status_code == 302